HPE AOS-10: Unauthenticated command injection in PAPI protocol
Summary
A command injection flaw in the PAPI protocol of HPE ArubaOS 10 (AOS-10) allows an adjacent attacker to send crafted packets without authentication. Successful exploitation can lead to remote code execution as a privileged user on the underlying operating system. The NVD record lists CVSS 8.3, but the vector differs between sources and must be verified.
Affected
- AOS-10.8.0.0 to 10.8.1.1
- AOS-10.7.0.0 to 10.7.2.6
- AOS-10.4.0.0 to 10.4.1.13
- Per the vendor data, the default configuration is affected.
Fixed in
- AOS-10.8.1.2
- AOS-10.7.2.7
- AOS-10.4.1.14
- Check the product table in the HPE advisory HPESBNW05162 before rollout, because the per-CVE mapping could not be confirmed from the full advisory text.
Workaround
- HPE general guidance: place CLI and web management interfaces on a dedicated VLAN or layer 2 segment, or restrict them with firewall rules, and enable accounting.
- No PAPI-specific workaround was found in HPE's text.
- Third-party guidance (not from HPE): block UDP port 8211 (PAPI) from network segments that do not need access to the controllers.
- Keep PAPI off guest and other untrusted network segments.
Exploitation
- HPE is not aware of any public discussion or exploit code targeting the listed vulnerabilities as of the advisory release date.
- No exploitation in the wild has been reported.
- A secondary source states the CVE is not in the CISA KEV catalogue; this was not verified directly.
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
Our recommendation
- Inventory all Aruba controllers, gateways and access points, and record whether each runs AOS-8 or AOS-10 and its exact build.
- Upgrade AOS-10 devices to 10.8.1.2, 10.7.2.7 or 10.4.1.14, or a later build on the same branch.
- Until the upgrade is done, block UDP 8211 and restrict management interfaces to a management VLAN.
- Test internally whether PAPI is reachable from guest or user networks.
- Verify the CVSS vector and the product mapping in the HPE advisory and the NVD record.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05162 support.hpe.com
- Cyberexperts: Aruba AOS wireless patches cyberexperts.com
- Carthage Electronics: CVE threat brief carthageelectronics.com
- Brandefense: CVE-2026-79844 knowledge hub brandefense.io
- Rescana: HPE Aruba AOS critical October 2026 www.rescana.com
- Cybaverse: HPE Aruba AOS critical flaws www.cybaverse.co.uk
- Vulners: PT-2026-121621 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:21.
Original description (NVD)
There is a command injection vulnerability in the PAPI protocol of AOS-10 that could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted packets. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.